Oracle International Corporation

Steven D Viavant

Leslie Gloyd

Joe McDonald

Bruce Eimon

Jeffrey Lynn McReynolds

Sashikanth Chandrasekaran

Gary Gilchrist

Richard R Wessman

Arthur A Gleckler

Lane Thomas Findley

One embodiment of the present invention provides a system that ensures an allowable client configuration for an application. During operation, the client sends a request to access the application to a server hosting the application. In response the request, the server downloads an analysis application to the client. Next, the client executes the analysis application, whereby the analysis application gathers configuration data that specifies a present configuration of the client. The system examines this configuration data to determine whether the client has a configuration that allows the application to execute on the client based on pre-established criteria. If the client has an allowable configuration, the system allows the client to execute the application.

Method and apparatus for ensuring an allowable client configuration for an application

One embodiment of the present invention provides a system for executing a command on a computer system. During operation, the system receives a signed command from a first quorum member at a security manager, wherein one or more quorum members must accept the command before the command is executed. Along with the command is data indicating which additional quorum members will be participating in a session, and which quorum persona they wish to invoke for the session. After verifying the signature, the system sends the command to a second quorum member, wherein the command is verified, or authenticated as originating from the first quorum member. Next, the system receives a signed response from the second quorum member, wherein the response indicates whether the second quorum member accepts or rejects the command. If the second quorum member accepts the command, the system sends the command to a native client which executes the command.

Method and apparatus for imposing quorum-based access control in a computer system

One embodiment of the present invention provides a system that facilitates adjusting an audit state in a computing environment. During operation the system receives a key from a third-party at an audit system. Note that the key is associated with a corresponding audit-control profile. Next, the system validates the key, thereby authenticating the third-party. The system then identifies the audit-control profile that is associated with the key provided by the third-party. Finally, the system audits the target system in accordance with the corresponding audit-control profile.

Method and apparatus for facilitating adjustment of an audit state in a computing environment

One embodiment of the present invention provides a method for authenticating an identity of a user in order to secure access to a host system. In this embodiment, the host system receives an identifier for the user from a client system. This identifier is used to retrieve a template containing biometric data associated with the user, and this template is returned to the client. The client then gathers a biometric sample from the user, and compares this biometric sample with the template to produce a comparison result. Next, the client computes a message digest using the template, the comparison result and an encryption key, and sends the message digest to the host system. This computation takes places within a secure hardware module within the client computing system that contains a secure encryption key in order to guard against malicious users on the client system. Next, the host system receives the message digest and authenticates the user by determining whether the message digest was computed using the template, the encryption key, and a comparison result indicating a successful match between the biometric sample and the template. If so, the host has confidence that the client has successfully matched the template with the biometric sample, and the client is allowed to access a service on the host system. By requiring the secure hardware in the client system to include the template in the message digest, the host system can guard against a malicious user who substitutes another template to gain unauthorized access to the host system. In a variation on this embodiment, the host system retrieves the template from a centralized repository for templates.

Trusted biometric client authentication

A system and a method are described for selecting and initiating security services for communication across computer networks. Negotiation is facilitated between nodes of a computer network to determine whether a security service is to be used, and if so, what particular method of providing the security service will be used. Communication with a wide range of different computer systems using different methods of providing various security services is thereby facilitated.

Growing community of inventors

Piedmont, CA, United States of America

Steven D Viavant